Feeds

€25k for an old Nokia handset?

Scammers pay through the nose for old tech

Top 5 reasons to deploy VMware with Tegile

Scammers are reportedly prepared to pay €25,000 for German Nokia 1100 handsets, on the basis that they can be reprogrammed to intercept SMS messages and thus crack banking security.

The claim comes from Ultrascan, a security association that generally follows up 419 scams and ID theft. Ultrascan tells us it was approached by Dutch police concerned that the price of a second-hand Nokia 1100 was unexpectedly rising. The company subsequently discovered that buyers were interested in a security flaw that makes the German version of the handset worth so much, though the technical background remains obscure.

The supposed exploit is based around codes - mTAN - that are sent to customers over SMS and are unique to each mobile-banking transaction. The premise is that criminals have "thousands" of login details and just lack these single-use codes, so are trying to get hold of Nokia 1100 handsets to intercept them.

The problem with this hypothesis is that the GSM security model is managed by the SIM, which colludes with the network's authentication server to create an encryption key which is made available to the handset. Communications can only be intercepted by getting hold of that key, or breaking the encryption itself, neither of which is easier to do while in possession of a Nokia 1100, German or otherwise.

We put these technical issues to Ultrascan who told us that it "did not investigate [the technical] part", but is hoping to get hold of a 1100 for testing in the next few days to see what is possible.

In the early days of GSM some operators introduced a critical flaw (zeros) into early versions of GSM cryptography, to enable the use of cheaper SIMs, but almost all operators have since upgraded to proper security and 3G networks have open algorithms that are well known to be pretty secure. Some countries, such as Pakistan, aren't permitted to use cryptography so still suffer from SIM-cloning and the like, but such places don't generally offer mobile banking for obvious reasons.

Ultrascan says it'll be in touch when it has more technical details, but for the moment it's beyond us how one phone can intercept calls made to a different SIM, and it seems more likely that one scammer is simply ripping off another with promises of magic handsets. ®

Remote control for virtualized desktops

More from The Register

next story
Mighty Blighty broadbanders beg: Let us lay cable in BT's, er, ducts
Complain to Ofcom that telco has 'effective monopoly'
BT said to have pulled patent-infringing boxes from DSL network
Take your license demand and stick it in your ASSIA
Yahoo! blames! MONSTER! email! OUTAGE! on! CUT! CABLE! bungle!
Weekend woe for BT as telco struggles to restore service
Fujitsu CTO: We'll be 3D-printing tech execs in 15 years
Fleshy techie disses network neutrality, helmet-less motorcyclists
Ofcom tackles complaint over Premier League footie TV rights
Virgin Media: UK fans pay the most for the fewest matches
FCC: Gonna need y'all to cough up $1.5bn to put broadband in schools
Kids need more fiber, says Wheeler, and you'll pay for it
prev story

Whitepapers

Go beyond APM with real-time IT operations analytics
How IT operations teams can harness the wealth of wire data already flowing through their environment for real-time operational intelligence.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.